Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
12s -
max time network
15s -
platform
windows10-2004_x64 -
resource
win10v2004-20230824-en -
resource tags
arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2023, 14:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://sblams.com
Resource
win10v2004-20230824-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
http://sblams.com
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 396 msedge.exe 396 msedge.exe 1864 msedge.exe 1864 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 396 msedge.exe 396 msedge.exe 396 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe 396 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 396 wrote to memory of 4016 396 msedge.exe 83 PID 396 wrote to memory of 4016 396 msedge.exe 83 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 4496 396 msedge.exe 86 PID 396 wrote to memory of 1864 396 msedge.exe 85 PID 396 wrote to memory of 1864 396 msedge.exe 85 PID 396 wrote to memory of 4072 396 msedge.exe 87 PID 396 wrote to memory of 4072 396 msedge.exe 87 PID 396 wrote to memory of 4072 396 msedge.exe 87 PID 396 wrote to memory of 4072 396 msedge.exe 87 PID 396 wrote to memory of 4072 396 msedge.exe 87 PID 396 wrote to memory of 4072 396 msedge.exe 87 PID 396 wrote to memory of 4072 396 msedge.exe 87 PID 396 wrote to memory of 4072 396 msedge.exe 87 PID 396 wrote to memory of 4072 396 msedge.exe 87 PID 396 wrote to memory of 4072 396 msedge.exe 87 PID 396 wrote to memory of 4072 396 msedge.exe 87 PID 396 wrote to memory of 4072 396 msedge.exe 87 PID 396 wrote to memory of 4072 396 msedge.exe 87 PID 396 wrote to memory of 4072 396 msedge.exe 87 PID 396 wrote to memory of 4072 396 msedge.exe 87 PID 396 wrote to memory of 4072 396 msedge.exe 87 PID 396 wrote to memory of 4072 396 msedge.exe 87 PID 396 wrote to memory of 4072 396 msedge.exe 87 PID 396 wrote to memory of 4072 396 msedge.exe 87 PID 396 wrote to memory of 4072 396 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://sblams.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb298546f8,0x7ffb29854708,0x7ffb298547182⤵PID:4016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,8616229555810874316,1291994480901727507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8616229555810874316,1291994480901727507,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,8616229555810874316,1291994480901727507,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵PID:4072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8616229555810874316,1291994480901727507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:12⤵PID:4684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8616229555810874316,1291994480901727507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:12⤵PID:2744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8616229555810874316,1291994480901727507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:12⤵PID:1696
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3256
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD53590c7788f1f36717cbd298007259a6f
SHA19e9a602016435a1d642e18a54d8d6589f938a5bb
SHA25609a08de2fcd19e304c3b8f6e04f5e4da257a3f18759827be4e9c6af862412174
SHA51207df3ee7e2d4a313c996c6b8451450556a75e5ac8e4d10595f255164fdd25d6bc596ad579d90f6496c78a15a3c6fc349d748dd7c5f4b2b51d330c52577e2988a
-
Filesize
5KB
MD59ca431d17ec30e8c63b498d2f10cbf14
SHA10fde626c6f4703f7d60a6b550ec309fea03e269a
SHA2564ab3dbb7884a1e5947d614b53b7edbbc3befded4e68030aa2bb0f186ed3ce902
SHA51296aec17ee7578642399b2c55476afff2ea8a855a057e871b3b470af348ad0935c35b31503af6c2c599e8f1b8a7d0a64d74df38483eff65d74683eb754a739bab
-
Filesize
10KB
MD50dbbcc1e7c36e8ac3ffb52573febd560
SHA124b12aa0ffe8344004227ee813cf1b53db37c00a
SHA256d07810d4fe80526817f2e8f6acd0ea17ad44d0bd275bc0770cef2dc3f1207729
SHA5127d424b5a5d0766efde12521cbf7f1a7fdf2f0a96831267a39a620758f8ad317ff33d62fe67068e3dd6f3793d7818e0be41a831536dcf559fd8f9fe6882688922